{"action":"Upgrade plone to 4.3.3 or later.","affected":[{"fixed":"4.3.3","introduced":"3.3"}],"component":"plone","cve_ids":["CVE-2013-7061"],"ecosystem":"PyPI","epss":0.01315,"exploited":false,"fixed_versions":["4.3.3"],"ghsa_id":"GHSA-4vr8-r7qr-fpvq","id":"tcs_01M5KG6B3W4B6BXTDJ4JNBTK37","modified_at":"2024-04-29T16:41:26.282695Z","published_at":"2014-05-02T14:55:00Z","references":["https://osv.dev/vulnerability/PYSEC-2014-66","https://plone.org/security/20131210/catalogue-exposure","http://www.openwall.com/lists/oss-security/2013/12/12/3","http://www.openwall.com/lists/oss-security/2013/12/10/15"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2014-66","url":"https://osv.dev/vulnerability/PYSEC-2014-66"}],"summary":"Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API."}